Optional
bypassOptional
bypassAllows users to bypass query analysis
Optional
encryptedSupply a schema for the encrypted fields in the document
Optional
extraOptional
cryptFull path to a MongoDB Crypt shared library to be used (instead of mongocryptd).
This needs to be the path to the file itself, not a directory.
It can be an absolute or relative path. If the path is relative and
its first component is $ORIGIN
, it will be replaced by the directory
containing the mongodb-client-encryption native addon file. Otherwise,
the path will be interpreted relative to the current working directory.
Currently, loading different MongoDB Crypt shared library files from different MongoClients in the same process is not supported.
If this option is provided and no MongoDB Crypt shared library could be loaded from the specified location, creating the MongoClient will fail.
If this option is not provided and cryptSharedLibRequired
is not specified,
the AutoEncrypter will attempt to spawn and/or use mongocryptd according
to the mongocryptd-specific extraOptions
options.
Specifying a path prevents mongocryptd from being used as a fallback.
Requires the MongoDB Crypt shared library, available in MongoDB 6.0 or higher.
Optional
cryptIf specified, never use mongocryptd and instead fail when the MongoDB Crypt shared library could not be loaded.
This is always true when cryptSharedLibPath
is specified.
Requires the MongoDB Crypt shared library, available in MongoDB 6.0 or higher.
Optional
mongocryptdIf true, autoEncryption will not attempt to spawn a mongocryptd before connecting
Optional
mongocryptdCommand line arguments to use when auto-spawning a mongocryptd
Optional
mongocryptdThe path to the mongocryptd executable on the system
Optional
mongocryptdURI?: stringA local process the driver communicates with to determine how to encrypt values in a command. Defaults to "mongodb://%2Fvar%2Fmongocryptd.sock" if domain sockets are available or "mongodb://localhost:27020" otherwise
Optional
keyA MongoClient
used to fetch keys from a key vault
Optional
keyThe namespace where keys are stored in the key vault
Optional
kmsConfiguration options that are used by specific KMS providers during key generation, encryption, and decryption.
Optional
aws?: Record<string, never> | { Configuration options for using 'aws' as your KMS provider
Optional
azure?: Record<string, never> | { Configuration options for using 'azure' as your KMS provider
Optional
gcp?: Record<string, never> | { Configuration options for using 'gcp' as your KMS provider
Optional
kmip?: { Configuration options for using 'kmip' as your KMS provider
Optional
endpoint?: stringThe output endpoint string. The endpoint consists of a hostname and port separated by a colon. E.g. "example.com:123". A port is always present.
Optional
local?: { Configuration options for using 'local' as your KMS provider
The master key used to encrypt/decrypt data keys. A 96-byte long Buffer or base64 encoded string.
Optional
optionsOptional
logger?: ((level, message) => void)An optional hook to catch logging messages from the underlying encryption engine
Optional
proxyOptional
schemaA map of namespaces to a local JSON schema for encryption
NOTE: Supplying options.schemaMap provides more security than relying on JSON Schemas obtained from the server. It protects against a malicious server advertising a false JSON Schema, which could trick the client into sending decrypted data that should be encrypted. Schemas supplied in the schemaMap only apply to configuring automatic encryption for Client-Side Field Level Encryption. Other validation rules in the JSON schema will not be enforced by the driver and will result in an error.
Optional
tlsThe TLS options to use connecting to the KMS provider
Optional
aws?: AutoEncryptionTlsOptionsOptional
azure?: AutoEncryptionTlsOptionsOptional
gcp?: AutoEncryptionTlsOptionsOptional
kmip?: AutoEncryptionTlsOptionsOptional
local?: AutoEncryptionTlsOptionsGenerated using TypeDoc
Allows the user to bypass auto encryption, maintaining implicit decryption